Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
06/10/2026, 15:01
General
- Target jaffacakes118_Trojan-Dropper.MSIL.Agent.sesjyo.exe
- Size 949KB
- Sample261006-sd6rrscw4q
- SHA256 fd799b918efa7023404d90b47d12c535623122fdf75b82671e86120e22b7e174
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.sesjyo.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.sesjyo.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\CRMSvc\CRMSvc.exe"C:\Users\Admin\AppData\Roaming\CRMSvc\CRMSvc.exe" --install2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" failure "CRMSvc" reset= 2 actions= restart/100003⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Roaming\CRMSvc\CRMSvc.exe"C:\Users\Admin\AppData\Roaming\CRMSvc\CRMSvc.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CRMSvc.InstallLog
CRMSvc.InstallLog
CRMSvc.exe
memory/5692-12-0x0000000000FC0000-0x000000000113E000-memory.dmp
memory/5692-35-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5692-36-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5692-34-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5692-21-0x00000000019C0000-0x00000000019D2000-memory.dmp
memory/5692-22-0x0000000001A30000-0x0000000001A6C000-memory.dmp
memory/5908-13-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5908-0-0x00007FFB361EF000-0x00007FFB361F0000-memory.dmp
memory/5908-11-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5908-5-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5908-6-0x000000001BE50000-0x000000001BFCE000-memory.dmp
memory/5908-4-0x000000001BCD0000-0x000000001BE4A000-memory.dmp
memory/5908-33-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5908-3-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5908-2-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/5908-1-0x0000000000EF0000-0x0000000000FE6000-memory.dmp
memory/5908-37-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp